trevon/fold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
fold/third_party/ghidra-decompiler/specs/x86/avx2_manual.sinc
trvon c08081a016
 feat: vendor x86-64 + 32-bit SLEIGH; precise SSA def-use; write-loop FP guard 
Unlocks the x86 family end-to-end and makes the write-loop detector precise
enough for statically-linked binaries.

x86 SLEIGH:
- Vendor Ghidra's x86 language specs (specs/x86, x86:LE:64:default + :32:default);
  add x86-64/x86 .sla build targets. archSpecFor maps x86/64 + x86/32.
- ghidra_lifter: set the x86-64 decode context (longMode/addrsize/opsize) in the
  raw path, and bound decompiler flow at the function end (0xC3 tail fill) so
  variable-length x86 does not run away into zero padding.

Precise SSA def-use (benefits all arches):
- ir::pcode::PcodeOp gains in_def (defining-op index per input); the SSA lifter
  records real def-use. summarizePointerWrites now resolves the store-address
  base via def-use instead of a last-write heuristic — essential on x86 where
  arg registers are reused as scratch (RAX) and sub-registers are written (SIL).
- paramIndexOf is arch-aware (AArch64 x0–x7; SysV x86-64 RDI/RSI/RDX/RCX/R8/R9).

Precision (the key fix at scale):
- A copy bounded by a size *parameter* (memcpy-like `for i<n`) is suppressed:
  if the loop index is `<`-compared against a pure parameter input, the function
  is size-bounded and not flagged. baby_bof's decode_base64 bounds on
  strlen(input) (a computed value, not a param) so it still fires. This cut a
  statically-linked x86-64 binary from 101 findings (≈100 glibc/libstdc++ FPs)
  to 1 — the real decode_base64 → 264-byte overflow.

Perf + reach:
- Cache the pre-pass SSA lift and reuse it in the main pass (re-lifting only the
  few callers of a write-loop callee that need the injected prototype).
- Give whole-binary r2 analysis a generous timeout (FOLD_R2_ANALYSIS_TIMEOUT_MS,
  default 120s) so large static binaries actually analyze (the 3s per-command
  watchdog left them with an empty function list).

Validated: decode_base64 overflow fires on x86-64 (index_amd64.cgi) and AArch64
(index_nocanary.cgi); AArch64 corpus BOF counts unchanged (3/1/1); x86-64 static
FP 101→1. Unit: test_pcode_summary +x86-64 case (9 assertions). meson test 77/77.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-01 10:34:28 -04:00

234 lines
11 KiB
Text
Raw Permalink Blame History

# VINSERTI128/VINSERTI32x4/VINSERTI64x2/VINSERTI32x8/VINSERTI64x4 5-314 PAGE 2138 LINE 109785
define pcodeop vinserti128 ;
:VINSERTI128 YmmReg1, vexVVVV_YmmReg, XmmReg2_m128, imm8 is $(VEX_NDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F3A) & $(VEX_W0) & vexVVVV_YmmReg; byte=0x38; YmmReg1 ... & XmmReg2_m128; imm8 & imm8_0 {
local tmp:16 = XmmReg2_m128;
local cond0:16 = zext((imm8_0:1 & 0x1) == 0);
local cond1:16 = zext((imm8_0:1 & 0x1) == 1);
# ignoring all but the least significant bit
YmmReg1[0,128] = (cond0 * tmp) + (cond1 * vexVVVV_YmmReg[0,128]);
YmmReg1[128,128] = (cond0 * vexVVVV_YmmReg[128,128]) + (cond1 * tmp);
}
# VGATHERDPD/VGATHERQPD 5-251 PAGE 2075 LINE 106903
define pcodeop vgatherdpd ;
:VGATHERDPD XmmReg1, q_vm32x, vexVVVV_XmmReg is $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_XmmReg; byte=0x92; (XmmReg1 & ZmmReg1) ... & q_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vgatherdpd(XmmReg1, q_vm32x, vexVVVV_XmmReg);
local tmp:16 = vgatherdpd(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
# VGATHERDPD/VGATHERQPD 5-251 PAGE 2075 LINE 106908
@ifdef IA64
define pcodeop vgatherqpd ;
:VGATHERQPD XmmReg1, q_vm64x, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_XmmReg; byte=0x93; (XmmReg1 & ZmmReg1) ... & q_vm64x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vgatherqpd(XmmReg1, q_vm64x, vexVVVV_XmmReg);
local tmp:16 = vgatherqpd(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
@endif
# VGATHERDPD/VGATHERQPD 5-251 PAGE 2075 LINE 106913
:VGATHERDPD YmmReg1, q_vm32x, vexVVVV_YmmReg is $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_YmmReg; byte=0x92; (YmmReg1 & ZmmReg1) ... & q_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vgatherdpd(YmmReg1, q_vm32x, vexVVVV_YmmReg);
YmmReg1 = vgatherdpd(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
# VGATHERDPD/VGATHERQPD 5-251 PAGE 2075 LINE 106918
@ifdef IA64
:VGATHERQPD YmmReg1, q_vm64y, vexVVVV_YmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_YmmReg; byte=0x93; (YmmReg1 & ZmmReg1) ... & q_vm64y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vgatherqpd(YmmReg1, q_vm64y, vexVVVV_YmmReg);
YmmReg1 = vgatherqpd(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
@endif
# VGATHERDPS/VGATHERQPS 5-256 PAGE 2080 LINE 107130
define pcodeop vgatherdps ;
:VGATHERDPS XmmReg1, d_vm32x, vexVVVV_XmmReg is $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x92; (XmmReg1 & ZmmReg1) ... & d_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vgatherdps(XmmReg1, d_vm32x, vexVVVV_XmmReg);
local tmp:16 = vgatherdps(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
# VGATHERDPS/VGATHERQPS 5-256 PAGE 2080 LINE 107135
@ifdef IA64
define pcodeop vgatherqps ;
:VGATHERQPS XmmReg1, d_vm64x, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x93; (XmmReg1 & ZmmReg1) ... & d_vm64x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vgatherqps(XmmReg1, d_vm64x, vexVVVV_XmmReg);
local tmp:16 = vgatherqps(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
@endif
# VGATHERDPS/VGATHERQPS 5-256 PAGE 2080 LINE 107140
:VGATHERDPS YmmReg1, d_vm32y, vexVVVV_YmmReg is $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_YmmReg; byte=0x92; (YmmReg1 & ZmmReg1) ... & d_vm32y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vgatherdps(YmmReg1, d_vm32y, vexVVVV_YmmReg);
YmmReg1 = vgatherdps(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
# VGATHERDPS/VGATHERQPS 5-256 PAGE 2080 LINE 107145
@ifdef IA64
:VGATHERQPS XmmReg1, d_vm64y, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x93; (XmmReg1 & ZmmReg1) ... & d_vm64y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vgatherqps(XmmReg1, d_vm64y, vexVVVV_XmmReg);
XmmReg1 = vgatherqps(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(XmmReg1);
vexVVVV_XmmReg = 0;
}
@endif
# PCMPEQQ 4-250 PAGE 1370 LINE 71171
:VPCMPEQQ YmmReg1, vexVVVV_YmmReg, YmmReg2_m256 is $(VEX_NDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_WIG) & vexVVVV_YmmReg; byte=0x29; (YmmReg1 & ZmmReg1) ... & YmmReg2_m256
{
local mask:8 = 0xffffffffffffffff;
YmmReg1[0,64] = zext(vexVVVV_YmmReg[0,64] == YmmReg2_m256[0,64]) * mask;
YmmReg1[64,64] = zext(vexVVVV_YmmReg[64,64] == YmmReg2_m256[64,64]) * mask;
YmmReg1[128,64] = zext(vexVVVV_YmmReg[128,64] == YmmReg2_m256[128,64]) * mask;
YmmReg1[192,64] = zext(vexVVVV_YmmReg[192,64] == YmmReg2_m256[192,64]) * mask;
ZmmReg1 = zext(YmmReg1);
}
# VPGATHERDD/VPGATHERQD 5-273 PAGE 2097 LINE 107884
define pcodeop vpgatherdd ;
:VPGATHERDD XmmReg1, d_vm32x, vexVVVV_XmmReg is $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x90; (XmmReg1 & ZmmReg1) ... & d_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vpgatherdd(XmmReg1, d_vm32x, vexVVVV_XmmReg);
local tmp:16 = vpgatherdd(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
# VPGATHERDD/VPGATHERQD 5-273 PAGE 2097 LINE 107888
@ifdef IA64
define pcodeop vpgatherqd ;
:VPGATHERQD XmmReg1, d_vm64x, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x91; (XmmReg1 & ZmmReg1) ... & d_vm64x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vpgatherqd(XmmReg1, d_vm64x, vexVVVV_XmmReg);
local tmp:16 = vpgatherqd(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
@endif
# VPGATHERDD/VPGATHERQD 5-273 PAGE 2097 LINE 107892
:VPGATHERDD YmmReg1, d_vm32y, vexVVVV_YmmReg is $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_YmmReg; byte=0x90; (YmmReg1 & ZmmReg1) ... & d_vm32y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vpgatherdd(YmmReg1, d_vm32y, vexVVVV_YmmReg);
YmmReg1 = vpgatherdd(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
# VPGATHERDD/VPGATHERQD 5-273 PAGE 2097 LINE 107896
@ifdef IA64
:VPGATHERQD XmmReg1, d_vm64y, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W0) & vexVVVV_XmmReg; byte=0x91; (XmmReg1 & ZmmReg1) ... & d_vm64y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vpgatherqd(XmmReg1, d_vm64y, vexVVVV_XmmReg);
local tmp:16 = vpgatherqd(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
@endif
# VPGATHERDQ/VPGATHERQQ 5-280 PAGE 2104 LINE 108234
define pcodeop vpgatherdq ;
:VPGATHERDQ XmmReg1, q_vm32x, vexVVVV_XmmReg is $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_XmmReg; byte=0x90; (XmmReg1 & ZmmReg1) ... & q_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vpgatherdq(XmmReg1, q_vm32x, vexVVVV_XmmReg);
local tmp:16 = vpgatherdq(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
# VPGATHERDQ/VPGATHERQQ 5-280 PAGE 2104 LINE 108238
@ifdef IA64
define pcodeop vpgatherqq ;
:VPGATHERQQ XmmReg1, q_vm64x, vexVVVV_XmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L128) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_XmmReg; byte=0x91; (XmmReg1 & ZmmReg1) ... & q_vm64x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# XmmReg1 = vpgatherqq(XmmReg1, q_vm64x, vexVVVV_XmmReg);
local tmp:16 = vpgatherqq(XmmReg1, vexVVVV_XmmReg);
ZmmReg1 = zext(tmp);
vexVVVV_XmmReg = 0;
}
@endif
# VPGATHERDQ/VPGATHERQQ 5-280 PAGE 2104 LINE 108242
:VPGATHERDQ YmmReg1, q_vm32x, vexVVVV_YmmReg is $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_YmmReg; byte=0x90; (YmmReg1 & ZmmReg1) ... & q_vm32x {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vpgatherdq(YmmReg1, q_vm32x, vexVVVV_YmmReg);
YmmReg1 = vpgatherdq(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
# VPGATHERDQ/VPGATHERQQ 5-280 PAGE 2104 LINE 108246
@ifdef IA64
:VPGATHERQQ YmmReg1, q_vm64y, vexVVVV_YmmReg is $(LONGMODE_ON) & $(VEX_DDS) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F38) & $(VEX_W1) & vexVVVV_YmmReg; byte=0x91; (YmmReg1 & ZmmReg1) ... & q_vm64y {
# TODO full semantics necessary for VSIB memory data access, leave out of data flow for now
# YmmReg1 = vpgatherqq(YmmReg1, q_vm64y, vexVVVV_YmmReg);
YmmReg1 = vpgatherqq(YmmReg1, vexVVVV_YmmReg);
ZmmReg1 = zext(YmmReg1);
vexVVVV_YmmReg = 0;
}
@endif
# PMOVMSKB 4-338 PAGE 1458 LINE 75655
:VPMOVMSKB Reg32, YmmReg2 is $(VEX_NONE) & $(VEX_L256) & $(VEX_PRE_66) & $(VEX_0F) & $(VEX_WIG); byte=0xD7; Reg32 & (mod=0x3 & YmmReg2) & check_Reg32_dest
{
local byte_mask:4 = 0:4;
byte_mask[0,1] = YmmReg2[7,1];
byte_mask[1,1] = YmmReg2[15,1];
byte_mask[2,1] = YmmReg2[23,1];
byte_mask[3,1] = YmmReg2[31,1];
byte_mask[4,1] = YmmReg2[39,1];
byte_mask[5,1] = YmmReg2[47,1];
byte_mask[6,1] = YmmReg2[55,1];
byte_mask[7,1] = YmmReg2[63,1];
byte_mask[8,1] = YmmReg2[71,1];
byte_mask[9,1] = YmmReg2[79,1];
byte_mask[10,1] = YmmReg2[87,1];
byte_mask[11,1] = YmmReg2[95,1];
byte_mask[12,1] = YmmReg2[103,1];
byte_mask[13,1] = YmmReg2[111,1];
byte_mask[14,1] = YmmReg2[119,1];
byte_mask[15,1] = YmmReg2[127,1];
byte_mask[16,1] = YmmReg2[135,1];
byte_mask[17,1] = YmmReg2[143,1];
byte_mask[18,1] = YmmReg2[151,1];
byte_mask[19,1] = YmmReg2[159,1];
byte_mask[20,1] = YmmReg2[167,1];
byte_mask[21,1] = YmmReg2[175,1];
byte_mask[22,1] = YmmReg2[183,1];
byte_mask[23,1] = YmmReg2[191,1];
byte_mask[24,1] = YmmReg2[199,1];
byte_mask[25,1] = YmmReg2[207,1];
byte_mask[26,1] = YmmReg2[215,1];
byte_mask[27,1] = YmmReg2[223,1];
byte_mask[28,1] = YmmReg2[231,1];
byte_mask[29,1] = YmmReg2[239,1];
byte_mask[30,1] = YmmReg2[247,1];
byte_mask[31,1] = YmmReg2[255,1];
Reg32 = zext(byte_mask);
build check_Reg32_dest;
}
Reference in a new issue View git blame Copy permalink